AMENDMENTS TO THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims; 



1 1 . (Currently amended) A memory device storing a data structure computer 

2 system for tracking network behavior, comprising: 

3 a processor: and 

4 a storage device storing a connection table that maps each node of a 

5 network to a record that 

6 stores information about traffic to or fi-om the node and between 

7 that node and others other nodes in the nctworkrr.11 , and 

8 stores information indicating whether the node is operating as a 

9 client or a server. 

1 2. (Currently amended) The computer svstemd evtee of claim 1 wherein 

2 the connection table includes a plurality of records that are indexed by source 

3 address. 

1 3. (Ciirrently amended) The computer svstemd e¥tee of claim 1 wherein 

2 the connection table includes a plurality of records that are indexed by destination 

3 address. 

1 4. (Currently amended) The computer system de^iee of claim 1 wherein 

2 the connection table includes a plurality of records that are indexed by time. 
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1 5. (Currently amended) The computer systemd evtee of claim 1 wherein 

2 the connection table includes a plurality of records, that are record objects, which 

3 are indexed by source address, destination address and time. 

1 6. (Currently amended) The computer systemd evtee of claim 1 wherein 

2 the connection table is a plurality of connection sub-tables each sub-table having 

3 data pertaining to network traffic over different time scales. 

1 7. (Currently amended) The computer svstemd e¥i€e of claim 6 wherein 

2 the connection sub-tables include a time-slice connection table that operates on a 

3 small unit of time and at least one other sub-table that operates on a larger unit of 

4 time than the time slice sub-table. 

1 8. (Currently amended) The computer system de¥iee of claim 7 wherein 

2 the at least one other sub-table holds records received from all from collectors 

3 over the time scale of the table. 

1 9. (Ciirrently amended) The computer systemd evtee of claim 5 wherein an 

2 address the addr e ss e s indexing the connection table ar e IP addr e ss e s comprises an 

3 IP address . 

1 10 (Ciirrently amended) The computer systemd evtee of claim 1 wherein 

2 th e addr e ss e s an address indexing the connection table includ e includes a physical 

3 layer address to IP address map that is used to determine Host ID. 

1 11. (Currently amended) The computer system dev4ee of claim 1 wherein 

2 the host a host record of a first host maps that first host to a second host that 

3 communicates with the first host to a host pair record object that has information 
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4 about all the t raffic from the first to the second host and from the second host to 

5 the first host. 

1 12. (Currently amended) The computer systemd evtee of claim 1 wherein 

2 the connection table includes two level mapping that enables a consuming device 

3 to obtain summary information about one host for a first level mapping and about 

4 the traffic traffic between any pair of hosts, in either direction, between a first em 

5 of the hosts host of the any pair to a second one of the hosts host of the any pair 

6 and from the second one of the hosts host of the any pair to the first on e of th e 

7 hostshost of the any pair for a second level mapping. 

1 13. (Currently amended) The computer systemd evtee of claim 1 wherein 

2 the connection table comprises a plurality of host records, a host record stores a 

3 measure of the number of bytes, packets, and connections that occurred between 

4 hosts during a time-period. 

1 14. (Currently amended) The computer systemd evtee of claim 13, wherein 

2 data in the host record is organized by well known fransport protocols and well- 

3 known application-level protocols. 

1 15. (Currently amended) The computer systemd evtee of claim 13, wherein 

2 host records have no specific memory limit. 

1 16. (Currently amended) The computer systemd evtee of claim 1 wherein 

2 for application-level protocols and for every pair of hosts, the connection table 

3 stores statistics for fraffic between [[the]] hosts. 
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1 17. (Currently amended) The computer systemd e¥t6e of claim 16 wherein 

2 the connection table stores protocol-specific records as (protocol, count) key- 

3 value pairs. 

1 18. (Currently amended) A computer system m e mory d e vic e storing a data 

2 structure for tracking network behavior, the computer syste m data structure 

3 comprising: 

4 a processor; and 

5 a storage device storing a connection table that maps each node of a 

6 network to a record that 

7 stores connection information about traffic to or from the node and 

8 between that node and e#tefs -other n odes that have connections with the 

9 node in the network, and 

10 stores information indicating whether the node is operating as a 

11 client or as a server. 

12 the connection table indexed according to at least a first one of 

1 3 source address, destination address and fetei -time: and 

14 the connection table fiirther including in the records fields for 

15 storing statistical information for traffic between [[the]] hosts. 

1 19 (Currently amended) The computer systemd eviee of claim 18 wherein 

2 the plurality of records is record objects. 

1 20. (Currently amended) The computer systemd eviee of claim 1 8 wherein 

2 the connection table is a second plurality of connection sub-tables, each sub-table 

3 having data pertaining to network traffic over different ones of corresponding 

4 second plurality of time scales. 
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1 21. (Currently amended) The computer systemd e¥t6e of claim 1 8 wherein 

2 the connection sub-tables include a time-slice connection table that operates on a 

3 small unit of time and at least one other sub-table that operates on a larger unit of 

4 time than the time slice sub-table. 

1 22. (Currently amended) The computer systemd evtee of claim 18 wherein 

2 the at least one other sub-table holds records received from all from collectors in 

3 the network over the time scale of the table. 

1 23. (Currently amended) The computer systemd evtee of claim 18 wherein 

2 th e addr e ss e s an address indexing the connection table ar e IP addr e ss e s. comprises 

3 an IP address. 

1 24. (Currently amended) The computer systemd e¥iee of claim 23 wherein 

2 th e addr e ss e s an address indexing the connection table includ e includes a physical 

3 layer address to IP address map that is used to determine Host ID. 
4 

5 25. (Currently amended) The computer systemd evtee of claim 18 wherein 



6 the host a host record of a first host maps that first host to a second host that 

7 communicates with the first host to a host pair record that has information about 

8 all the t raffic from the first to the second host and from the second host to the first 

9 host. 

1 26. (Currently amended) The computer systemd evtee of claim 18 wherein 

2 the connection table includes two level mapping that enables a consuming device 

3 to obtain summary information about one host for a first level mapping and about 

4 the traffic between any pair of hosts, in either direction, between a first one of the 

5 heste -host of the any pair to a second one of the hosts host of the any pair and from 
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6 the second one of the hosts host of the any pair to the first on e of th e hosts host of 

7 the any pair for a second level mapping. 

1 27. (Currently amended) The computer systemd evtee of claim 18 wherein 

2 the connection table comprises a plurality of host records, a host record stores, a 

3 measure of the number of bytes, packets, and connections that occurred between 

4 hosts during a time-period. 

1 28. (Currently amended) The computer system de¥iee of claim 27 wherein 

2 data in the host record is organized by well known transport protocols and well- 

3 known application-level protocols. 

1 29. (Currently amended) The computer systemd evtee of claim 28 wherein 

2 for application-level protocols and for every pair of hosts, the connection table 

3 stores statistics for traffic between [[the]] hosts. 

1 30 (Currently amended) The computer systemd evtee of claim 28 wherein 

2 the connection table stores protocol-specific records as (protocol, count) key- 

3 value pairs. 
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